Re: Question re: sql injection

Andrew Hutchings wrote:
shimmyshack wrote:
On Jun 28, 10:28 pm, jb <jbri...@xxxxxxxxx> wrote:
does wrapping the string in double quotes somehow tell mysql to treat
the contents within as literal? Thus making it sql injection safe?

just use myql_real_escape_string throughout.

That won't cover things like unicode sql injection attacks for starters. Prepared statements are much safer but you need mysqli on your PHP installation (or a lot of voodoo with the standard mysql library).


Actually, it will. mysql_real_escape_string is charset dependent. If you're using one of the unicode charsets in your table, mysql_real_escape_string will handle it. And if you're not using unicode, the injection won't work, anyway.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@xxxxxxxxxxxxx
==================
.

Relevant Pages

  • Re: Question re: sql injection
    ... That won't cover things like unicode sql injection attacks for starters. ... Windows is the path to the darkside...Windows leads to Blue Screen. ... Downtime leads to suffering...I sense much Windows in you... ...
    (comp.lang.php)
  • Re: Question re: sql injection
    ... That won't cover things like unicode sql injection attacks for starters. ... Prepared statements are much safer but you need mysqli on your PHP installation. ... if your not using unicode a certain malformed unicode character can cause an apostrophe which then can lead to injection. ...
    (comp.lang.php)
  • Re: XHTML 1.0 Strict and the Apostrophe
    ... For starters, Unicode names have no semantics (they cannot even be ... pasted programming code from one of those auto-smart-quoting comment ...
    (comp.infosystems.www.authoring.html)
  • Re: Is prepare statement enough for SQL injection?
    ... any examples of SQL injection even if I use the prepare statement? ... prepared statements are not magical (in fact they don't even really ... it easier to write safer code, because they facilitate use of bind ... But you can write unsafe code with prepare just as easily as ...
    (comp.lang.perl.misc)
  • Re: Newbie Security Questions
    ... proper way to protect against SQL injection is usually a combination ... of sprintf() or intval, and mysql_real_escape_string. ... Or prepared statements. ...
    (comp.lang.php)